To stop the cluster, type docker-compose down. Data volumes will persist, so it’s possible to start the cluster again with the same data using docker-compose up.
To destroy the cluster and the data volumes just type docker-compose down -v.

The image offers several methods for configuring Elasticsearch settings with the conventional approach being to provide customized files, i.e. elasticsearch.yml, but it’s also possible to use environment variables to set options:

The container runs Elasticsearch as user elasticsearch using uid:gid 1000:1000. Bind mounted host directories and files, such as custom_elasticsearch.yml above, need to be accessible by this user. For the data and log dirs, such as /usr/share/elasticsearch/data, write access is required as well.

Elasticsearch inside the container runs as user elasticsearch using uid:gid 1000:1000. If you are bind mounting a local directory or file, ensure it is readable by this user while the data and log dirs additionally require write access.

It is important to correctly set capabilities and ulimits via the Docker CLI. As seen earlier in the example docker-compose.yml, the following options are required:

If you are using the devicemapper storage driver (default on at least RedHat (rpm) based distributions) make sure you are not using the default loop-lvm mode. Configure docker-engine to use direct-lvm instead.

Consider centralizing your logs by using a different logging driver. Also note that the default json-file logging driver is not ideally suited for production use.